Conversation

Notices

1. PunishedD (punishedd@clubcyberia.co)'s status on Wednesday, 21-Aug-2024 11:51:11 JST PunishedD
   "Nothing ever happens. I wish something would hap-- OH GOD NO NOT LIKE THIS"
   • CrunkLord420 likes this.
   •  (mint@ryona.agency)'s status on Wednesday, 21-Aug-2024 22:25:13 JST 

     in reply to

     • laurel
     @laurel @PunishedD There's a bunch of other measures suggested in the original post.
     https://notes.valdikss.org.ru/jabber.ru-mitm/
     New Janny in Town likes this.
   •  (mint@ryona.agency)'s status on Wednesday, 21-Aug-2024 22:25:14 JST 

     in reply to

     • laurel
     @laurel @PunishedD Not exactly, those were g*rman authorities making Hetzner add another hop in the route and issuing letsencrypt cert. With access to domain and Cloudflare's dashboard you don't even need that since it issues valid certs automatically and the IP is going to be somewhere in https://www.cloudflare.com/ips-v4/ regardless.
   • laurel (laurel@fsebugoutzone.org)'s status on Wednesday, 21-Aug-2024 22:25:14 JST laurel

     in reply to

     • 
     @mint @PunishedD
     
     Damn, that could only be prevented by having disable the http-01 certificate challenge type with a dns record. And having configured acme to use the registrars api to update the certs.
   •  (mint@ryona.agency)'s status on Wednesday, 21-Aug-2024 22:25:15 JST 

     in reply to

     • 
     @PunishedD And it looks like it wasn't anything more than some zoomer obtaining access to the domain and changing the nameservers to deface the site immediately. If he didn't have an ipad baby brain, he would've MitMed it for admin/mod passwords or something in order to at least present something of value.
     image.png
   • laurel (laurel@fsebugoutzone.org)'s status on Wednesday, 21-Aug-2024 22:25:15 JST laurel

     in reply to

     • 
     @mint @PunishedD
     
     >If he didn't have an ipad baby brain, he would've MitMed it for admin/mod passwords or something in order to at least present something of value.
     Isn't this what recently happened with those Russian xmpp servers? Attackers got domain access for just a few hours, used it to issue certificates and then arp poisoned the hosting network to serve as a proxy.
   •  (mint@ryona.agency)'s status on Wednesday, 21-Aug-2024 22:25:16 JST 

     in reply to
     @PunishedD Hilarious!
     1724204084608.png